How does Microsoft 365 help with the FTC Safeguards Rule?

Key facts

• The Rule applies to non-bank financial institutions such as auto dealers, mortgage brokers and tax preparers.
• MFA is required for anyone accessing information systems that hold customer information.
• Customer information must be encrypted in transit and at rest.
• Certain security events involving 500 or more consumers must be reported to the FTC.
• Microsoft 365 provides controls; the program, documentation and decisions are yours.

Who the Rule covers and what it asks

The FTC Standards for Safeguarding Customer Information, known as the Safeguards Rule, apply to financial institutions under FTC jurisdiction that are not banks. That includes many businesses that do not think of themselves as financial firms: auto dealers that arrange financing, mortgage brokers, tax preparers, payday lenders, some wealth and finance advisers, and collection agencies.

The amended Rule requires a written information security program with specific elements. Some are technical and map directly to Microsoft 365. Others are governance tasks that no software can do for you. Confirm with your counsel whether and how the Rule applies to your business.

Where Microsoft 365 controls fit

Microsoft 365 Business Premium or E3 with the right add-ons covers most of the technical requirements for a typical SMB. The table maps common requirements to the Microsoft features used to meet them.

What Microsoft 365 does not do for you

Several requirements are about people, decisions and documents. These usually take more effort than turning on features.

• Designate a Qualified Individual to run the program, in-house or through a service provider you oversee.
• Write a risk assessment that identifies risks to customer information and how controls address them.
• Run security awareness training and keep records.
• Oversee service providers by contract and periodic review.
• Test controls through continuous monitoring, or annual penetration testing and vulnerability assessments at least every six months.
• Keep a written incident response plan and report to the board or senior officer at least yearly.
• Notify the FTC, within the required window, of qualifying events involving unencrypted information of 500 or more consumers.

A practical order of work

Start with identity, because MFA is explicit in the Rule and closes the most common attack path. Then encrypt and manage every device that touches customer data with Intune, set retention and disposal rules in Purview, and confirm logs are retained and reviewed. In parallel, the Qualified Individual writes the risk assessment and the program document, referencing the controls as evidence.

Keep an evidence folder: Conditional Access policy exports, Intune compliance reports, retention policy settings, training records and incident response plan versions. It makes the annual report and any FTC inquiry far easier.

How Accred Consulting approaches it

Accred Consulting configures the Microsoft 365 controls that support a Safeguards Rule program. Discovery maps where customer information lives, your licensing and current controls against the Rule's technical elements. The proposal sets a clear scope, fixed price and timeline. US-based specialists then implement MFA and Conditional Access, Intune encryption and compliance, Purview retention and labels, and logging, and produce configuration evidence your Qualified Individual can reference. Accred does not certify compliance; you, your counsel and your assessor own it. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions